docs: restore SECURITY.md on v2/main, so the next tree swap can't drop it - #1867
Merged
Conversation
…p it Closes #1864. SECURITY.md was restored to main in #1843 but never added to v2/main. Because v2/main is the develop branch merged into main at milestones, and the two share no common git ancestor, the next milestone merge would silently remove the security policy from the default branch a second time. Copied byte-for-byte from main (sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
This was referenced Jul 31, 2026
There was a problem hiding this comment.
Pull request overview
Restores the repository’s SECURITY.md file on v2/main to ensure the security policy remains present and consistent across branch milestone merges, avoiding regressions from future tree-level operations.
Changes:
- Adds
SECURITY.mdtov2/main(content copied as-is frommain) so the security policy is not inadvertently dropped during future merges.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Aug 1, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1864.
Recreated from #1865, which GitHub auto-closed when its head branch was renamed
docs/restore-security-md-v2→v2/docs/restore-security-md-v2to satisfy the version-prefix branch convention. Same commit, same content; #1865 could not be reopened because its original head ref no longer exists.Follow-up to #1843, and the same reasoning that moved #1851 onto
v2/main.The gap
SECURITY.mdwas restored tomainin #1843, but it was never added tov2/main.v2/mainis the develop branch, merged intomainat milestone releases. Every milestone merge therefore has to re-resolve this file's absence on the develop side, and any future tree-level operation risks removing the security policy from the default branch a second time. Adding it here makes the two branches agree.The change
Copied byte-for-byte from
main— sha256bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes, verified after the copy. No content changes: #1843 already wrote this file for the post-swap world, so it describes the v2 single-package model and thev1-latestdist-tag correctly as-is.Testing
No source files are touched, so no
validate/coveragegate measures this change.npx prettier --check SECURITY.mdpasses.Note
.github/workflows/claude.yml(#1851) and this file are the two known instances. Anything else restored directly tomainafter the swap is suspect for the same reason — a sweep is probably worth doing separately.🤖 Generated with Claude Code
https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU